diff --git a/.changeset/patch-update-documentation-2025-10-28.md b/.changeset/patch-update-documentation-2025-10-28.md
new file mode 100644
index 00000000000..5f0e232b312
--- /dev/null
+++ b/.changeset/patch-update-documentation-2025-10-28.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Update documentation for features from 2025-10-28
diff --git a/docs/src/content/docs/reference/frontmatter-full.md b/docs/src/content/docs/reference/frontmatter-full.md
index 624fe141703..9895876378b 100644
--- a/docs/src/content/docs/reference/frontmatter-full.md
+++ b/docs/src/content/docs/reference/frontmatter-full.md
@@ -526,7 +526,8 @@ on:
 
   # Time when workflow should stop running. Supports multiple formats: absolute
   # dates (YYYY-MM-DD HH:MM:SS, June 1 2025, 1st June 2025, 06/01/2025, etc.) or
-  # relative time deltas (+25h, +3d, +1d12h30m)
+  # relative time deltas (+25h, +3d, +1d12h30m). Note: Minute-only units (e.g., +30m)
+  # are not allowed; use hours instead (e.g., +1h).
   # (optional)
   stop-after: "example-value"
 
diff --git a/docs/src/content/docs/reference/triggers.md b/docs/src/content/docs/reference/triggers.md
index 95339b512e3..9cab951e6be 100644
--- a/docs/src/content/docs/reference/triggers.md
+++ b/docs/src/content/docs/reference/triggers.md
@@ -170,7 +170,7 @@ on:
   stop-after: "+25h"  # 25 hours from compilation time
 ```
 
-Accepts absolute dates (`YYYY-MM-DD`, `MM/DD/YYYY`, `DD/MM/YYYY`, `January 2 2006`, `1st June 2025`, ISO 8601) or relative deltas (`+7d`, `+25h`, `+1d12h`) calculated from compilation time. The minimum unit for relative deltas is hours (`h`). Recompiling the workflow resets the stop time.
+Accepts absolute dates (`YYYY-MM-DD`, `MM/DD/YYYY`, `DD/MM/YYYY`, `January 2 2006`, `1st June 2025`, ISO 8601) or relative deltas (`+7d`, `+25h`, `+1d12h30m`) calculated from compilation time. The minimum granularity is hours - minute-only units (e.g., `+30m`) are not allowed. Recompiling the workflow resets the stop time.
 
 ## Related Documentation
 
diff --git a/docs/src/content/docs/tools/cli.md b/docs/src/content/docs/tools/cli.md
index 76f14d5fd6e..b033515bf6f 100644
--- a/docs/src/content/docs/tools/cli.md
+++ b/docs/src/content/docs/tools/cli.md
@@ -154,15 +154,23 @@ gh aw compile --workflows-dir custom/      # Custom workflows directory
 # Dependency management
 gh aw compile --dependabot                 # Generate dependency manifests
 gh aw compile --dependabot --force         # Force overwrite existing files
+
+# Security scanning
+gh aw compile --zizmor                     # Run zizmor security scanner on compiled workflows
+gh aw compile --strict --zizmor            # Strict mode: treat zizmor findings as errors
 ```
 
 **Validation:**
 
 The `--validate` flag enables GitHub Actions workflow schema validation and container image validation. By default, validation is disabled for faster compilation. Enable it when you need to verify workflow correctness or validate that container images exist and are accessible.
 
+**Security Scanning:**
+
+The `--zizmor` flag runs the [zizmor](https://github.com/woodruffw/zizmor) security scanner on generated `.lock.yml` files after compilation. Zizmor identifies security issues such as template injection vulnerabilities, dangerous permissions, and other workflow security risks. When findings are detected, they are displayed with file locations and descriptions, but compilation succeeds by default. Use with `--strict` to treat security findings as compilation errors.
+
 **Strict Mode:**
 
-Enables enhanced security validation requiring timeouts, explicit network configuration, and blocking write permissions. Use `--strict` flag or `strict: true` in frontmatter.
+Enables enhanced security validation requiring timeouts, explicit network configuration, and blocking write permissions. When combined with `--zizmor`, strict mode treats any zizmor security findings as compilation errors, requiring workflows to have zero security warnings before they can be deployed. Use `--strict` flag or `strict: true` in frontmatter.
 
 **Repository Feature Validation:**
 
diff --git a/docs/src/content/docs/tools/mcp-server.md b/docs/src/content/docs/tools/mcp-server.md
index 901a7181d07..37c383e26a4 100644
--- a/docs/src/content/docs/tools/mcp-server.md
+++ b/docs/src/content/docs/tools/mcp-server.md
@@ -122,6 +122,28 @@ The logs tool uses a 50-second default timeout to prevent MCP server timeouts wh
 
 Agents can detect incomplete data by checking for the `continuation` field and make follow-up calls with the provided `before_run_id` to fetch remaining logs.
 
+**Output Size Guardrail:**
+
+The logs tool includes a token-based output guardrail (default: 12,000 tokens, ~48KB) to prevent overwhelming responses. When output exceeds the limit, the tool returns a structured response with:
+
+- Warning message explaining the token limit
+- Complete JSON schema of the LogsData structure
+- Suggested jq queries for common filtering scenarios
+
+The limit can be customized using the `max_tokens` parameter:
+
+```json
+{
+  "name": "logs",
+  "arguments": {
+    "count": 100,
+    "max_tokens": 20000
+  }
+}
+```
+
+When the guardrail triggers, use the provided jq queries to filter the data. For example, to get only failed runs, use `jq: '.runs | map(select(.conclusion == "failure"))'`.
+
 **Large Output Handling:**
 
 When tool outputs exceed 16,000 tokens (~64KB), the MCP server automatically writes content to `/tmp/gh-aw/safe-outputs/` and returns a JSON response with file location and schema description: